BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

1 Introduction

NIST PIV and digital identity FIPS 201-3 against FIPS 201-2
All changes in this version
modified 1 Introduction

Title

Introduction

Control changed

Before · FIPS 201-2

Authentication of an individual’s identity is a fundamental component of physical and logical access control processes. When an individual attempts to access security-sensitive buildings, computer systems, or data, an access control decision must be made. An accurate determination of an individual’s identity is needed to make sound access control decisions.

A wide range of mechanisms is employed to authenticate an identity, utilizing various classes of identity credentials. For physical access, an individual’s identity has traditionally been authenticated by use of paper or other non-automated, hand-carried credentials, such as driver’s licenses and badges. Access authorization to computers and data has traditionally been based on identities authenticated through user- selected passwords. More recently, cryptographic mechanisms and biometric techniques have been used in physical and logical security applications, replacing or supplementing the traditional identity credentials.

The strength of the authentication that is achieved varies, depending upon the type of credential, the process used to issue the credential, and the authentication mechanism used to validate the credential. This document establishes a standard for a Personal Identity Verification (PIV) system based on secure and reliable forms of identity credentials issued by the Federal government to its employees and contractors. These credentials are intended to authenticate individuals who require access to Federally controlled facilities, information systems, and applications. This Standard addresses requirements for initial identity proofing, infrastructures to support interoperability of identity credentials, and accreditation of organizations and processes issuing PIV credentials.

After · FIPS 201-3

This section is informative except where otherwise marked as normative. It provides background information for understanding the scope of this Standard.

Authentication of an individual’s identity is a fundamental component of both physical and logical access control processes. WhenAn access control decision must be made when an individual attempts to access security-sensitive buildings, computerinformation systems, or data, an access control decision must beand madeapplications. An accurate determination of an individual’s identity is needed tosupports makemaking sound access control decisions.

AIn widethe rangepast, ofvarious mechanisms ishave been employed to authenticate an identity, utilizing various classes of identity credentialsindividual. For physical access, an individual’s identity has traditionally been authenticated by use of paper or otherThese non-automated,include hand-carried credentials, such as driver’s licensesbadges and badges. Accessdriver’s authorizationlicenses tofor computersphysical andaccess datato hasfederal traditionallyfacilities beenand basedpasswords onfor identitieslogical authenticatedaccess throughto user-federal selectedinformation passwordssystems. More recentlyToday, cryptographic mechanisms and biometric techniques haveare beenreplacing usedthese legacy mechanisms in both physical and logical securityaccess applications,.

This replacingdocument orestablishes supplementinga theStandard traditionalfor identitya credentials.

ThePersonal strengthIdentity ofVerification the(PIV) authenticationsystem that is achieved varies, depending uponmeets the typecontrol ofand credential,security theobjectives processof used[HSPD-12]. toThe issueStandard thespecifies credential,implementation and theprocesses authenticationfor mechanismbinding usedidentities to validateauthenticators, thesuch credential.as Thisintegrated documentcircuit establishescards aand standardderived forcredentials aused Personalin Identitythe Verificationfederal (PIV) system. The system is based on secure and reliable forms of identity credentials issued by the Federal governmentGovernment to its employees and contractors. These credentials are intended to authenticate individuals who require access to Federally controlledfederally-controlled facilities, information systems, and applications. ThisThe Standard addresses requirements for initial identity proofing, infrastructuresinfrastructure to support interoperability of identity credentials, and accreditation of organizations and processes issuing PIV credentials.

Each revision of this Standard incorporates lessons learned and adaptations to changes in the environment as experienced by departments and agencies. This revision broadens the definition of derived PIV credentials to accommodate a diverse and growing set of user device platforms. Interoperability of these PIV credentials across the federal government can be achieved via federation as outlined in this Standard and further defined in [SP 800-217]. As envisioned by OMB [M-19-17], this revision also expands lifecycle activities to encompass PIV identity accounts, where all PIV credentials including derived PIV credentials are managed and maintained.